Chapter 3 - Security Management Concepts & Principles.pdf

Security Management Concepts & Principles

1. Information Systems Security
Presented By
Dr. Mohamed Marie

2. Chapter 3
Security ManagementConcepts
and Principles
This chapter presents the following:
Security Management Concepts and Principles
Protection Mechanisms
Change Control/Management
Data Classification

3. Protection Mechanisms
Anotheraspectofsecuritysolutionconceptsandprinciplesis
theelementofprotectionmechanisms.Thesearecommon
characteristicsofsecuritycontrols.Notallsecuritycontrols
musthavethem,butmanycontrolsoffertheirprotectionfor
confidentiality,integrity,andavailabilitythroughtheuse
ofthesemechanisms.Thesemechanismsincludeusing
multiplelayersorlevelsofaccess,employingabstraction,
hidingdata,andusingencryption.

4. Protection Mechanisms
Layering
Layering,alsoknownasdefenseindepth,issimplytheuseofmultiple
controlsinaseries.Noonecontrolcanprotectagainstallpossible
threats.Usingamultilayeredsolutionallowsfornumerous,different
controlstoguardagainstwhateverthreatscometopass.Whensecurity
solutionsaredesignedinlayers,mostthreatsareeliminated,mitigated,
orthwarted.
Usinglayersinaseriesratherthaninparallelisimportant.
Performingsecurityrestrictionsinaseriesmeanstoperformoneafter
theotherinalinearfashion.Onlythroughaseriesconfigurationwilleach
attackbescanned,evaluated,ormitigatedbyeverysecuritycontrol.A
singlefailureofasecuritycontroldoesnotrendertheentiresolution
ineffective.Ifsecuritycontrolswereimplementedinparallel,athreat
couldpassthroughasinglecheckpointthatdidnotaddressitsparticular
maliciousactivity.Serialconfigurationsareverynarrowbutverydeep,
whereasparallelconfigurationsareverywidebutveryshallow.
Parallelsystemsareusefulindistributedcomputingapplications,but
parallelismisnotoftenausefulconceptintherealmofsecurity.

5. Protection Mechanisms
Layering
Thinkofphysicalentrancestobuildings.Aparallelconfigurationisused
forshoppingmalls.Therearemanydoorsinmanylocationsaroundthe
entireperimeterofthemall.Aseriesconfigurationwouldmostlikelybe
usedinabankoranairport.Asingleentranceisprovided,andthat
entranceisactuallyseveralgatewaysorcheckpointsthatmustbe
passedinsequentialordertogainentryintoactiveareasofthe
building.Layeringalsoincludestheconceptthatnetworkscomprise
numerousseparateentities,eachwithitsownuniquesecuritycontrolsand
vulnerabilities.Inaneffectivesecuritysolution,thereisasynergybetween
allnetworkedsystemsthatcreatesasinglesecurityfront.Usingseparate
securitysystemscreatesalayeredsecuritysolution.

6. Protection Mechanisms
Abstraction
Abstractionisusedforefficiency.Similarelementsareputintogroups,
classes,orrolesthatareassignedsecuritycontrols,restrictions,or
permissionsasacollective.Thus,theconceptofabstractionisusedwhen
classifyingobjectsorassigningrolestosubjects.Theconceptof
abstractionalsoincludesthedefinitionofobjectandsubjecttypesorof
objectsthemselves(thatis,adatastructureusedtodefineatemplatefora
classofentities).Abstractionisusedtodefinewhattypesofdataan
objectcancontain,whattypesoffunctionscanbeperformedonorby
thatobject,andwhatcapabilitiesthatobjecthas.Abstractionsimplifies
securitybyenablingyoutoassignsecuritycontrolstoagroupofobjects
collectedbytypeorfunction.

7. Protection Mechanisms
Data Hiding
Datahidingisexactlywhatitsoundslike:preventingdatafrombeing
discoveredoraccessedbyasubjectbypositioningthedatainalogical
storagecompartmentthatisnotaccessibleorseenbythesubject.
Keepingadatabasefrombeingaccessedbyunauthorizedvisitorsisa
formofdatahiding,asisrestrictingasubjectatalowerclassification
levelfromaccessingdataatahigherclassificationlevel.
Preventinganapplicationfromaccessinghardwaredirectlyisalsoa
formofdatahiding.Datahidingisoftenakeyelementinsecuritycontrols
aswellasinprogramming.

8. Protection Mechanisms
Encryption
Encryptionistheartandscienceofhidingthemeaningorintentofa
communicationfromunintendedrecipients.
Encryptioncantakemanyformsandbeappliedtoeverytypeof
electroniccommunication,includingtext,audio,andvideofiles,aswell
asapplicationsthemselves.Encryptionisanimportantelementinsecurity
controls,especiallyinregardtothetransmissionofdatabetween
systems.Therearevariousstrengthsofencryption,eachofwhichis
designedand/orappropriateforaspecificuseorpurpose.

9. Change Control/Management
Anotherimportantaspectofsecuritymanagementisthecontrolormanagementof
change.Changeinasecureenvironmentcanintroduceloopholes,overlaps,
missingobjects,andoversightsthatcanleadtonewvulnerabilities.Theonly
waytomaintainsecurityinthefaceofchangeistosystematicallymanage
change.Thisusuallyinvolvesextensiveplanning,testing,logging,auditing,and
monitoringofactivitiesrelatedtosecuritycontrolsandmechanisms.The
recordsofchangestoanenvironmentarethenusedtoidentifyagentsofchange,
whetherthoseagentsareobjects,subjects,programs,communicationpathways,or
eventhenetworkitself.
Thegoalofchangemanagementistoensurethatanychangedoesnotleadto
reducedorcompromisedsecurity.Changemanagementisalsoresponsiblefor
makingitpossibletorollbackanychangetoaprevioussecuredstate.Change
managementcanbeimplementedonanysystemdespitethelevelofsecurity.
Ultimately,changemanagementimprovesthesecurityofanenvironmentby
protectingimplementedsecurityfromunintentional,tangential,oraffected
diminishments.Althoughanimportantgoalofchangemanagementistoprevent
unwantedreductionsinsecurity,itsprimarypurposeistomakeallchanges
subjecttodetaileddocumentationandauditingandthusabletobereviewed
andscrutinizedbymanagement.

10. Change Control/Management
Changemanagementshouldbeusedtooverseealterationstoeveryaspectofa
system,includinghardwareconfigurationandOSandapplicationsoftware.
Changemanagementshouldbeincludedindesign,development,testing,
evaluation,implementation,distribution,evolution,growth,ongoing
operation,andmodification.Itrequiresadetailedinventoryofeverycomponent
andconfiguration.Italsorequiresthecollectionandmaintenanceofcomplete
documentationforeverysystemcomponent,fromhardwaretosoftwareandfrom
configurationsettingstosecurityfeatures.

11. Change Control/Management
The change control process of configuration or change management has several
goals or requirements:
•Implement changes in a monitored and orderly manner. Changes are
always controlled.
•A formalized testing process is includedto verify that a change produces
expected results.
•All changes can be reversed.
•Users are informed of changes before they occurto prevent loss of
productivity.
•The effects of changes are systematically analyzed.
•The negative impact of changes on capabilities, functionality, and
performance is minimized.

12. Change Control/Management
Oneexampleofachangemanagementprocessisaparallelrun,whichisatypeof
newsystemdeploymenttestingwherethenewsystemandtheoldsystemare
runinparallel.Eachmajororsignificantuserprocessisperformedoneach
systemsimultaneouslytoensurethatthenewsystemsupportsallrequiredbusiness
functionalitythattheoldsystemsupportedorprovided.

13. Data Classification
Dataclassificationistheprimarymeansbywhichdataisprotectedbasedonits
needforsecrecy,sensitivity,orconfidentiality.Itisinefficienttotreatalldatathe
samewhendesigningandimplementingasecuritysystembecausesomedataitems
needmoresecuritythanothers.Securingeverythingatalowsecuritylevelmeans
sensitivedataiseasilyaccessible.Securingeverythingatahighsecuritylevelis
tooexpensiveandrestrictsaccesstounclassified,noncriticaldata.Data
classificationisusedtodeterminehowmucheffort,money,andresourcesare
allocatedtoprotectthedataandcontrolaccesstoit.
Theprimaryobjectiveofdataclassificationschemesistoformalizeandstratifythe
processofsecuringdatabasedonassignedlabelsofimportanceandsensitivity.
Dataclassificationisusedtoprovidesecuritymechanismsforstoring,
processing,andtransferringdata.Italsoaddresseshowdataisremovedfroma
systemanddestroyed

14. Data Classification
The following are benefits of using a data classification scheme:
•Itdemonstratesanorganization’scommitmenttoprotectingvaluable
resourcesandassets.
•Itassistsinidentifyingthoseassetsthataremostcriticalorvaluabletothe
organization.
•Itlendscredencetotheselectionofprotectionmechanisms.
•Itisoftenrequiredforregulatorycomplianceorlegalrestrictions.
•Ithelpstodefineaccesslevels,typesofauthorizeduses,andparametersfor
declassification,and/ordestructionofnolongervaluableresources.

15. Data Classification
Thecriteriabywhichdataisclassifiedvarybasedontheorganization
performingtheclassification.However,youcangleannumerousgeneralities
fromcommonorstandardizedclassificationsystems:
•Usefulnessof the data
•Timelinessof the data
•Valueor costof the data
•Maturityor ageof the data
•Lifetimeof the data (or when it expires)
•Associationwith personnel
•Data disclosure damage assessment(that is, how the disclosure of the data
would affect the organization)
•Data modification damage assessment(that is, how the modification of the
data would affect the organization)
•National security implicationsof the data
•Authorized access to the data(that is, who has access to the data)
•Restriction from the data(that is, who is restricted from the data)
•Maintenance and monitoringof the data (that is, who should maintain and
monitor the data)
•Storageof the data

16. Data Classification
Usingwhatevercriteriaisappropriatefortheorganization,dataisevaluated,andan
appropriatedataclassificationlabelisassignedtoit.Insomecases,thelabelis
addedtothedataobject.Inothercases,labelingissimplyassignedbythe
placementofthedataintoastoragemechanismorbehindasecurityprotection
mechanism.Toimplementaclassificationscheme,youmustperformsevenmajor
stepsorphases:
•Identifythecustodian,anddefinetheirresponsibilities.
•Specifytheevaluationcriteriaofhowtheinformationwillbeclassifiedand
labeled.
•Classifyandlabeleachresource.(Theownerconductsthisstep,buta
supervisorshouldreviewit.)
•Documentanyexceptionstotheclassificationpolicythatarediscovered,and
integratethemintotheevaluationcriteria.
•Selectthesecuritycontrolsthatwillbeappliedtoeachclassificationlevelto
providethenecessarylevelofprotection.
•Specifytheproceduresfordeclassifyingresourcesandtheproceduresfor
transferringcustodyofaresourcetoanexternalentity.
•Createanenterprisewideawarenessprogramtoinstructallpersonnelabout
theclassificationsystem.

17. Data Classification
Declassificationisoftenoverlookedwhendesigningaclassificationsystemand
documentingtheusageprocedures.Declassificationisrequiredonceanassetno
longerwarrantsorneedstheprotectionofitscurrentlyassignedclassificationor
sensitivitylevel.Inotherwords,iftheassetwerenew,itwouldbeassignedalower
sensitivitylabelthanitcurrentlyisassigned.Whenassetsfailtobedeclassifiedas
needed,securityresourcesarewasted,andthevalueandprotectionofthehigher
sensitivitylevelsisdegraded.

18. Data Classification
Thetwocommonclassificationschemesaregovernment/militaryclassification
andcommercialbusiness/privatesectorclassification.
Therearefivelevelsofgovernment/militaryclassification(listedherefrom
highesttolowest):
TopsecretThehighestlevelofclassification.Theunauthorizeddisclosureoftop-
secretdatawillhavedrasticeffectsandcausegravedamagetonationalsecurity.
SecretUsedfordataofarestrictednature.Theunauthorizeddisclosureofdata
classifiedassecretwillhavesignificanteffectsandcausecriticaldamageto
nationalsecurity.
ConfidentialUsedfordataofaconfidentialnature.Theunauthorizeddisclosureof
dataclassifiedasconfidentialwillhavenoticeableeffectsandcauseserious
damagetonationalsecurity.Thisclassificationisusedforalldatabetweensecret
andsensitivebutunclassifiedclassifications.
SensitivebutunclassifiedUsedfordataofasensitiveorprivatenature,butthe
disclosureofthisdatawouldnotcausesignificantdamage.
UnclassifiedThelowestlevelofclassification.Thisisusedfordatathatisneither
sensitivenorclassified.Thedisclosureofunclassifieddatadoesnotcompromise
confidentialityorcauseanynoticeabledamage.

19. Data Classification
Theclassificationsofconfidential,secret,andtopsecretarecollectivelyknown
orlabeledasclassified.Often,revealingtheactualclassificationofdatato
unauthorizedindividualsisaviolationofthatdata.Thus,thetermclassifiedis
generallyusedtorefertoanydatathatisrankedabovethesensitivebut
unclassifiedlevel.AllclassifieddataisexemptfromtheFreedomofInformation
Actaswellasmanyotherlawsandregulations.TheU.S.militaryclassification
schemeismostconcernedwiththesensitivityofdataandfocusesontheprotection
ofconfidentiality(thatis,thepreventionofdisclosure).Youcanroughlydefine
eachlevelorlabelofclassificationbythelevelofdamagethatwouldbecausedin
theeventofaconfidentialityviolation.Datafromthetop-secretlevelwould
causegravedamagetonationalsecurity,whiledatafromtheunclassifiedlevel
wouldnotcauseanyseriousdamagetonationalorlocalizedsecurity.

20. Data Classification
Thefourlevelsofcommercialbusiness/privatesectorclassification(listed
highesttolowest)areasfollows:
ConfidentialThehighestlevelofclassification.Thisisusedfordatathatis
extremelysensitiveandforinternaluseonly.Asignificantnegativeimpactcould
occurforacompanyifconfidentialdataisdisclosed.Sometimesthelabel
proprietaryissubstitutedforconfidential.
PrivateUsedfordatathatisofaprivateorpersonalnatureandintendedfor
internaluseonly.Asignificantnegativeimpactcouldoccurforthecompanyor
individualsifprivatedataisdisclosed.
SensitiveUsedfordatathatismoreclassifiedthanpublicdata.Anegativeimpact
couldoccurforthecompanyifsensitivedataisdisclosed.
PublicThelowestlevelofclassification.Thisisusedforalldatathatdoesnotfitin
oneofthehigherclassifications.Itsdisclosuredoesnothaveaseriousnegative
impactontheorganization.